Splunk 6.6.3, clustered env. One of our indexers reporting high disk usage. Traced it down to
/opt/splunk/var/run/splunk/cluster/search-buckets containing many
summarize_sitedefault_gen*.csv.gz files going back to 22 days ago (December 12 at this time). I deleted older ones to stop triggering our disk use alerts.
Whats creating these files and why?
This was a combination of two bugs that were fixed in later versions of splunk (7.0.8+, 7.1.6+, 7.2.4+)
For a workaround, its safe to
for example, if i have:
searchsitedefaultgen1000.csv.gz as the latest file, i can delete searchsitedefaultgen(1-990).csv.gz safely
but remember this is per site, so if i have the latest:
searchsite0gen1000.csv.gz (delete gen1-990 for site0, dont delete gen0)
searchsite1gen3500.csv.gz (delete gen1-3490 for site1, dont delete gen0)
This is NOT a helpful answer and does not explain why there are so many of these files in this directory path. There apparently is no documentation from Splunk on this. I am opening a case as I suggest everyone else having this does the same.
@ddrillic thanks for responding but not related. I need to know what is creating the above files in /opt/splunk/var/run/splunk/cluster/search-buckets. I just had to delete files from all of my indexers to have available space. Never had to do this before our upgrade to 6.6.3.
Hi, can anyone provide input as to what is creating
summarize_sitedefault_gen*.csv.gz files in